The CERT-In Empanelled List, Explained: What It Is, and India's 6-Hour Rule

Key takeaways

• The empanelled list certifies auditing organizations, not incident response firms. It exists so Indian entities can satisfy the directions' mandatory audit requirement. A breach responder does not need empanelment to respond, and most of the best-known response names will never appear on it.
• India's reporting clock is six hours. The CERT-In Directions of April 28, 2022 require covered incidents to be reported within 6 hours of noticing, not 72 hours (GDPR) or 60 days (HIPAA).
• The audits are annual and mandatory. Covered entities must have their ICT systems audited at least once a year by a CERT-In empanelled auditing organization, with logs enabled and retained for 180 days inside India.
• The list is public and current. CERT-In publishes the empanelled, provisionally empanelled, and applicant lists itself and updates them as they change. We verified the list and the directions pages on October 21, 2026.

What the empanelled list is

CERT-In, the Indian Computer Emergency Response Team, sits under India's Ministry of Electronics and Information Technology as the national CERT under section 70B of the Information Technology Act, 2000. Among its functions, it empanels information security auditing organizations: firms vetted to perform the ICT security audits that Indian regulations require.

The scheme publishes three states, each on CERT-In's own site:

• Empanelled organizations (the current valid list: cert-in.org.in, PDF/Empanel_org.pdf)
• Provisionally empanelled organizations (PDF/Prov_Empanel_org.pdf)
• Applicant organizations (the empanelment scheme page: cert-in.org.in/certEmpanelment.jsp)

CERT-In's own wording on the list matters for buyers: it is the "up-to-date valid list," refreshed as soon as anything changes. Any vendor claiming empanelment should be checkable against it by name, which is exactly why the list is the right diligence instrument.

The 2022 directions behind it

The Directions under sub-section (6) of section 70B of the IT Act, dated April 28, 2022, are the rule set that makes the list load-bearing. Their best-known requirements, for service providers, intermediaries, data centres, body corporates, and government organizations:

• Report covered cyber incidents to CERT-In within 6 hours of noticing. Not after the investigation, not after containment. Six hours from noticing, using CERT-In's reporting channels.
• Enable and retain logs for 180 days within India, in CERT-In's prescribed format.
• Get ICT systems audited at least once a year by a CERT-In empanelled auditing organization.
• Synchronize system clocks to the NIC or NPL network time servers.

CERT-In followed with an official FAQ on the directions and an extension of certain enforcement timelines for MSMEs (dated June 27, 2022). As of our read on October 21, 2026, the official directions page lists the original directions, the FAQ, and that MSME extension. Verify current requirements against CERT-In directly before relying on any timeline in your plan.

How India's clock compares

A breach touching Indian operations runs the shortest clock in the world alongside all the others. The free breach notification deadline calculator computes the HIPAA, GDPR, SEC, and US state clocks from your dates; India's 6-hour rule is stated here because it is measured in hours, and your plan should treat it the same way: the moment an India-affected incident is noticed, the clock is nearly over.

What the list is not

The empanelled list is not a directory of incident response firms. Empanelment certifies an organization to perform compliance audits. Response and forensics are a different discipline with a different evidence model, and a firm's absence from the auditing list says nothing about its ability to handle a live incident.

We ran the honest check against our own directory: the India-region firms currently documented in it do not appear on the empanelled auditing list as of our October 2026 read. That is correct and unsurprising, they are documented for response and security services, not as CERT-In audit shops. The two disciplines meet at the incident, not on the list: when a breach hits, you need responders at 2 a.m. and an empanelled auditor afterward for the compliance trail.

If a breach hits your India operations

1. Notice starts the clock. Six hours to CERT-In, through counsel where privilege allows. Build this trigger into the IR plan's first-hour checklist, before the investigative timeline.
2. Counsel first, responders through counsel. The privilege mechanics are the same as everywhere else, just faster.
3. Keep the logs. The 180-day retention requirement means log preservation decisions made in hour one are also compliance decisions.
4. The audit follows. The annual audit by an empanelled organization is where the list becomes your shopping list, and the state breach notification laws guide maps the other layers that may apply.